350-401 questions and answers

(laboratory validated)
BR2#show ip bgp
Network Next Hop Metric LocPrf Weight Path
* i209.165.201.0/27 172.24.109.2 0 100 0 200 i
*> 209.165.200.230 0 0 300 i
BR2#show ip bgp
Network Next Hop Metric LocPrf Weight Path
* i209.165.201.0/27 172.24.109.2 0 100 0 200 i
*> 209.165.200.230 1 0 300 i

neighbor 10.2.2.2 has smaller interface MTU

https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/7-5/High_Availability_DG.html

VTEP (Virtual Tunnel Endpoint) - This is the device that does the encapsulation and de-encapsulation.

The BGP session may report in the following states 1 Idle: the initial state of a BGP connection. In this state, the BGP speaker is waiting for a BGP start event, generally either the establishment of a TCP connection or the re-establishment of a previous connection. Once the connection is established, BGP moves to the next state.
2 Connect: In this state, BGP is waiting for the TCP connection to be formed. If the TCP connection completes, BGP will move to the Open Sent stage; if the connection cannot complete, BGP goes to Active 3 Active: In the Active state, the BGP speaker is attempting to initiate a TCP session with the BGP speaker it wants to peer with. If this can be done, the BGP state goes to Open Sent state. 4 Open Sent: the BGP speaker is waiting to receive an OPEN message from the remote BGP speaker 5 Open Confirm: Once the BGP speaker receives the OPEN message and no error is detected, the BGP speaker sends a KEEPALIVE message to the remote BGP speaker 6 Established: All of the neighbor negotiations are complete. You will see a number, which tells us the number of prefixes the router has received from a neighbor or peer group.

In Locator/ID Separation Protocol, the ingress tunnel router is responsible for encapsulating traffic from an endpoint identifier toward the correct routing locator. When the ITR does not already have an EID-to-RLOC mapping in its local map cache, it must request that mapping through the LISP control plane. The component that receives map requests from ITRs is the Map Resolver. Therefore, option A is correct. A routing locator is not a query target; it is the routable address representing the location of an EID in the underlay or routing infrastructure. A proxy ingress tunnel router is used to connect non-LISP sites toward LISP sites by acting on behalf of non-LISP sources. A proxy egress tunnel router provides reachability in the reverse direction, helping LISP sites communicate with non-LISP destinations. Neither PITR nor PETR is the normal answer to an ITR mapping-resolution request. The core ENCOR point is the separation between endpoint identity and routing location, with map resolution handled by the LISP control plane. References/topics: ENCOR Architecture, LISP, ITR, Map Resolver, EID-to-RLOC mapping, SD-Access control plane concepts.

References:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/405
https://developer.mozilla.org/en-US/docs/Web/HTTP/Status
Invalid authentication credentials would return code 401

A stack master retains its role unless one of these events occurs:

1. The switch stack is reset.* 2. The stack master is removed from the switch stack.
3. The stack master is reset or powered off.
4. The stack master fails.
5. The switch stack membership is increased by adding powered-on standalone switches or switch stacks.*

In the events marked by an asterisk (*), the current stack master might be re-elected based on the listed factors.
When you power on or reset an entire switch stack, some stack members might not participate in the stack master election. Stack members that are powered on within the same 20-second time frame participate in the stack master election and have a chance to become the stack master. Stack members that are powered on after the 20-second time frame do not participate in this initial election and become stack members. All stack members participate in re-elections. For all powering considerations that affect stack-master elections, see the "Switch Installation" chapter in the hardware installation guide. The new stack master becomes available after a few seconds. In the meantime, the switch stack uses the forwarding tables in memory to minimize network disruption. The physical interfaces on the other available stack members are not affected during a new stack master election and reset. After a new stack master is elected and the previous stack master becomes available, the previous stack master does not resume its role as stack master. As described in the hardware installation guide, you can use the Master LED on the switch to see if the switch is the stack master.

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_55_se/configuration/guide/3750xscg/swstack.html

https://www.ansible.com/

Ansible Automation Platform has grown over the past years to provide powerful automation solutions that work for operators, administrators and IT decision makers across a variety of technology domains. It's a leading enterprise automation solution from Red Hat®, a thriving open source community, and the de facto standard technology of IT automation.

BOOK: ccnp-and-ccie-enterprise-core-encor-350-401-official-cert-guide

Chapter 29. Introduction to Automation Tools

Puppet Bolt connects to devices by using SSH or WinRM connections. Puppet Bolt is an open source tool that is based on the Ruby language and can be installed as a single package.

"Orchestrator-driven tasks: Orchestrator-driven" tasks can leverage the Puppet architecture to use services to connect to devices. This design is meant for large-scale environments.

BFD provides a low-overhead, short-duration method of detecting failures in the forwarding path between two adjacent routers, including the interfaces, data links, and forwarding planes. BFD is a detection protocol that you enable at the interface and routing protocol levels

SD-Access Wireless Architecture Control Plane Node Closer Look Fabric Control-Plane Node is based on a LISP Map Server / Resolver Runs the LISP Endpoint ID Database to provide overlay reachability information + A simple Host Database, that tracks Endpoint ID to Edge Node bindings (RLOCs)
+ Host Database supports multiple types of Endpoint ID (EID), such as IPv4 /32, IPv6 /128* or MAC/48
+ Receives prefix registrations from Edge Nodes for wired clients, and from Fabric mode WLCs for wireless clients
+ Resolves lookup requests from FE to locate Endpoints
+ Updates Fabric Edge nodes, Border nodes with wireless client mobility and RLOC information

References:
https://www.ciscolive.com/c/dam/r/ciscolive/latam/docs/2018/pdf/BRKEWN-2020.pdf

The established keyword is only applicable to TCP access list entries to match TCP segments that have the ACK and/or RST control bit set (regardless of the source and destination ports), which assumes that a TCP connection has already been established in one direction only. Let's see an example below:

Suppose you only want to allow the hosts inside your company to telnet to an outside server but not vice versa, you can simply use an "established" access-list like this: access-list 100 permit tcp any any established access-list 101 permit tcp any any eq telnet ! interface S0/0 ip access-group 100 in ip access-group 101 out

OMP Routes, also referred to as vRoutes, are prefixes learned at the local site via connected interfaces, static routes, and dynamic routing protocols (such as OSPF, EIGRP, and BGP) running on the service side of the vEdge. These prefixes are redistributed into OMP and advertised to the vSmart controller so that they can be carried across the overlay fabric to all other WAN edge nodes. OMP routes resolve their next-hop to a TLOC. An OMP route is installed in the forwarding table only if the next-hop TLOC is known and there is a BFD session in UP state associated with that TLOC;

Maybe something was wrong with this question but we still have to choose the best answers.

Ref: Cisco SD-WAN (Viptela) Configuration Guide, Release 18.1

"...
Segmentation (VPN) Overview

This article illustrates the segmentation and VPN capabilities of the Viptela overlay network solution.

Network segmentation has existed for over a decade and has been implemented in multiple forms and shapes. At its most rudimentary level, segmentation provides traffic isolation. The most common forms of network segmentation are virtual LANs, or VLANs, for Layer 2 solutions, and virtual routing and forwarding, or VRF, for Layer 3 solutions.
..."

There is nothing special with the configuration of Gi0/0 on R1. Only Gi0/0 interface on R2 is assigned to VRF VPN_A. The default VRF here is similar to the global routing table concept in Cisco IOS

Configuration management tools are used to install, configure, and manage software or applications on existing systems. They commonly work with mutable infrastructure, where systems can be updated or modified after deployment.

Orchestration tools are used to provision and coordinate infrastructure resources, such as server instances. They commonly align with immutable infrastructure, where infrastructure is replaced rather than modified in place. Cisco describes configuration-management tools as managing deployments on existing server instances and orchestration tools as provisioning server instances; Cisco also distinguishes mutable infrastructure from immutable infrastructure.

The stratum levels define the distance from the reference clock. A reference clock is a stratum 0 device that is assumed to be accurate and has little or no delay associated with it. Stratum 0 servers cannot be used on the network but they are directly connected to computers which then operate as stratum-1 servers. A stratum 1 time server acts as a primary network time standard.

A stratum 2 server is connected to the stratum 1 server; then a stratum 3 server is connected to the stratum 2 server and so on. A stratum 2 server gets its time via NTP packet requests from a stratum 1 server. A stratum 3 server gets its time via NTP packet requests from a stratum-2 server... A stratum server may also peer with other stratum servers at the same level to provide more stable and robust time for all devices in the peer group (for example a stratum 2 server can peer with other stratum 2 servers). NTP uses the concept of a stratum to describe how many NTP hops away a machine is from an authoritative time source. A stratum 1 time server typically has an authoritative time source (such as a radio or atomic clock, or a Global Positioning System (GPS) time source) directly attached, a stratum 2 time server receives its time via NTP from a stratum 1 time server, and so on.

References:
https://www.cisco.com/c/en/us/td/docs/routers/asr920/configuration/guide/bsm/16-6-1/b-bsm-xe-16-6-1-asr920/bsm-time-calendar-set.html

JWT: JSON Web Tokens are an open and standard (RFC 7519) way for you to represent your user's identity securely during a two-party interaction. That is to say, when two systems exchange data you can use a JSON Web Token to identify your user without having to send private credentials on every request.

References:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type

Syslog points to local router having VIP ip 10.1.1.25, and remote router in g0/0 interface having 10.1.1.1. We want latter to all routers in HSRP so we need to configure local router, hence B.
"is different to the locally configured..."

When a labeled packet is received with a TTL of 1, the receiving LSR drops the packet and sends an ICMP message "time exceeded" (type 11, code 0) to the originator of the IP packet. This is the same behavior that a router would exhibit with an IP packet that had an expiring TTL.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_010111000.html#:~:text=The%20local%20and%20FlexConnect%20mode%20access%20points,spend%20about%2050%20milliseconds%20on%20each%20channel.

The inbound direction of G0/0 of SW2 only filter traffic from Web Server to PC-1 so the source IP address and port is of the Web Server.

because the question is asked about 'UpTime', not 'family', both of them are object within array 'response' ,i.e. [ {"family:xxx", "UpTime:xxx"}...

StackWise Virtual (SV) combines two switches into a single logical network entity from the network control plane and management perspectives.
References:
https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-9000/nb-06-cat-9k-stack-wp-cte-en.html

A GRE interface definition includes:

+ An IPv4 address on the tunnel + A tunnel source + A tunnel destination

Below is an example of how to configure a basic GRE tunnel:

interface Tunnel 0 ip address 10.10.10.1 255.255.255.0 tunnel source fa0/0 tunnel destination 172.16.0.2

In this case the "IPv4 address on the tunnel" is 10.10.10.1/24 and "sourced the tunnel from an Ethernet interface" is the command "tunnel source fa0/0". Therefore it only needs a tunnel destination, which is 172.16.0.2.

Note: A multiple GRE (mGRE) interface does not require a tunnel destination address.

With 's' GET
https://DNAC:Port//dna/intent/api/v1/network-devices

{
"response": {
"errorCode": "Bad request",
"message": "Invalid input request",
"detail": "s is not a valid UUID of device"
},
"version": "1.0"
}

without 's' GET
https://DNAC:Port//dna/intent/api/v1/network-device
{
"response": [
{
"type": "Cisco 3504 Wireless LAN Controller", "description": "Cisco Controller Wireless Version:8.5.140.0",
"serialNumber": "FOL25040021",

EIGRP provides a mechanism to load balance over unequal cost paths (or called unequal cost load balancing) through the "variance" command. In other words, EIGRP will install all paths with metric < variance * best metric into the local routing table, provided that it meets the feasibility condition to prevent routing loop. The path that meets this requirement is called a feasible successor. If a path is not a feasible successor, it is not used in load balancing. Note: The feasibility condition states that, the Advertised Distance (AD) of a route must be lower than the feasible distance of the current successor route.

A system should validate access rights to all its resources to ensure that they are allowed and should not rely on the cached permission matrix. If the access level to a given resource is being revoked, but that is not being reflected in the permission matrix, it would be violating security.

https://medium.com/strike-sh/rest-security-design-principles-434bd6ee57ea

Access Points
+ AP is directly connected to FE (or to an extended node switch)
+ AP is part of Fabric overlay

References:
https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2018/pdf/BRKEWN-2020.pdf

In the context of Cisco Catalyst 9800 Series Wireless Controllers, a policy tag is used to define the properties that will be applied to each specific WLAN. The policy tag maps the WLAN profile to the policy profile, which in turn defines the wireless characteristics of the WLAN and the network policies and switching policies for the client 2.
References:
Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide

The Cisco switch was configured with PAgP, which is a Cisco proprietary protocol so non-Cisco switch could not communicate.

only GLBP can maximize utilzation of links by being ACTIVE/ACTIVE while all others are ACTIVE/STANDBY/LISTENING

NOTE!!!! there is NO MHSRP only HSRP v1 and 2.

Runs on SD-WAN tunnel to detect failures in the overlay tunnel

Is enabled by default and cannot be disabled

Is typically enabled for OMP

Besides link failures, it also measures latency, loss, and other link statistics used by application-aware routing
https://www.cisco.com/c/en/us/td/docs/routers/sdwan/configuration/routing/ios-xe-17/routing-book-xe/m-bfd-for-routing-protocols.html#Cisco_Concept.dita_26cf6354-cce5-4799-b140-f518adc78a40

The command "ip nat inside source list 1 interface gigabitethernet0/0 overload" translates all source addresses that pass access list 1, which means 172.16.1.0/24 subnet, into an address assigned to gigabitethernet0/0 interface. Overload keyword allows to map multiple IP addresses to a single registered IP address (many-to-one) by using different ports so it is called Port Address Translation (PAT).

Rogue Detection is performed by Local and Flex-Connect (in connected mode) mode APs and utilizes a time-slicing technique which allows client service and channel scanning with the usage of the same radio. With the move to off channel for a period of 50ms every 16 seconds, the AP, by default, only spends a small percentage of its time to not serve clients.

Monitor mode serves only to scan, not to serve clients.

Monitor mode APs are also far superior at the detection of rogue clients as they have a more comprehensive view of the activity that occurs in each channel.

Just as @YTAKE, @Adrenalina73, @xziomal9, @wifishark and others say.

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/112045-handling-rogue-cuwn-00.html#anc8

You have to go with VRRP as the protocol must be vendor agnostic.

What is a Mobility Anchor?
Mobility Anchor, also referred to as Guest tunneling or Auto Anchor Mobility, is a feature where all the client traffic that belongs to a WLAN (Specially Guest WLAN) is tunneled to a predefined WLC or set of controllers that are configured as Anchor for that specific WLAN. This feature helps to restrict clients to a specific subnet and have more control over the user traffic. Refer to theConfiguring Auto-Anchor Mobilitysection of Cisco Wireless LAN Controller Configuration Guide, Release 8.8for more information on this feature.

This would be a L3 Roam as the client is Anchored to the AP with a CAPWAP tunnel formed between the Anchor WLC and the associated WLC
https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/107188-mobility-groups-faq.html#anc15

In the above output, the IP address of "209.165.202.130" is the tunnel source IP while the IP 10.111.1.1 is the tunnel IP address.

"ip nhrp registration no-unique": allow the client to not set the unique flag in the NHRP packets. This is useful when a station has a dynamic IP address that could change over time.